@aifabrix/builder 2.46.0 → 2.47.0

package/lib/commands/up-dataplane.js

@@ -29,7 +29,12 @@ const { checkHealthEndpoint } = require('../utils/health-check');
 const { validateControllerUrl } = require('../utils/auth-config-validator');
 const app = require('../app');
 const { assertDevInfraUp } = require('./dev-infra-gate');
-const { ensureAppFromTemplate, validateEnvOutputPathFolderOrNull, refreshUrlsLocalRegistryForCurrentProject } = require('./up-common');
+const { dataplaneDockerHostPort } = require('../utils/declarative-url-ports');
+const {
+  ensureDataplaneAppsFromTemplate,
+  validateEnvOutputPathFolderOrNull,
+  refreshUrlsLocalRegistryForCurrentProject
+} = require('./up-common');
 
 const CONTROLLER_HEALTH_PATH = '/health';
 
@@ -198,8 +203,7 @@ function computeDataplanePortOverride(runEnvKey, developerIdNum) {
   if (runEnvKey !== 'dev' && runEnvKey !== 'tst') {
     return undefined;
   }
-  const baseHostPort = 3001 + (Number.isFinite(developerIdNum) ? developerIdNum : 0) * 100;
-  return runEnvKey === 'dev' ? baseHostPort + 10 : baseHostPort + 20;
+  return dataplaneDockerHostPort(3001, developerIdNum, runEnvKey);
 }
 
 function assertDevEnvironmentForDataplane(cfg) {
@@ -243,7 +247,7 @@ async function handleUpDataplane(options = {}) {
       : await resolveEnvironment();
   const { controllerUrl, authConfig } = await resolveUpDataplaneAuthContext(options, environmentKey);
 
-  await ensureAppFromTemplate('dataplane');
+  await ensureDataplaneAppsFromTemplate();
   // If envOutputPath target folder does not exist, set envOutputPath to null
   validateEnvOutputPathFolderOrNull('dataplane');
 

package/lib/commands/upload.js

@@ -32,6 +32,7 @@ const {
   resolveConfigurationValues,
   collectResolvedVariableConfigurationNames
 } = require('../utils/configuration-env-resolver');
+const { pushRuntimeConfigurationValues } = require('../utils/runtime-configuration-values');
 const { validateExternalSystemComplete } = require('../validation/validate');
 const { displayValidationResults } = require('../validation/validate-display');
 const { generateControllerManifest } = require('../generator/external-controller-manifest');
@@ -219,6 +220,24 @@ async function pushAndLogCredentialSecrets(dataplaneUrl, authConfig, systemKey,
   if (pushResult.warning) {
     logger.log(chalk.yellow(`Warning: ${pushResult.warning}`));
   }
+  try {
+    const configPush = await pushRuntimeConfigurationValues(
+      dataplaneUrl,
+      authConfig,
+      systemKey,
+      payload
+    );
+    if (configPush.pushed > 0) {
+      const nameList = configPush.names.length ? ` (${configPush.names.join(', ')})` : '';
+      logger.log(
+        formatSuccessLine(
+          `Stored ${configPush.pushed} runtime configuration value(s) in dataplane${nameList}.`
+        )
+      );
+    }
+  } catch (err) {
+    logger.log(chalk.yellow(`Warning: runtime configuration store skipped: ${err.message}`));
+  }
 }
 
 /**
@@ -314,7 +333,7 @@ async function buildValidatedUploadManifestPayload(systemKey, opts = {}) {
  * @param {Object} manifest
  * @returns {Promise<void>}
  */
-async function logAndSyncLocalOpenApiForUpload(systemKey, manifest) {
+async function logAndSyncLocalOpenApiForUpload(systemKey, manifest, uploadContext = {}) {
   const appPath = getIntegrationPath(systemKey);
   const ei = manifest && manifest.externalIntegration;
   const datasourceFiles = ei && Array.isArray(ei.dataSources) ? ei.dataSources : [];
@@ -323,7 +342,9 @@ async function logAndSyncLocalOpenApiForUpload(systemKey, manifest) {
     dryRun: false,
     appPath,
     systemKey,
-    datasourceFiles
+    datasourceFiles,
+    dataplaneUrl: uploadContext.dataplaneUrl,
+    authConfig: uploadContext.authConfig
   });
   for (const line of openapiSyncLines) {
     logger.log(line.startsWith('Skipped') ? formatWarningLine(line) : formatSuccessLine(line));
@@ -372,7 +393,7 @@ async function runUploadPublishAndSummary(systemKey, options, manifest, payload)
   await pushAndLogCredentialSecrets(dataplaneUrl, authConfig, systemKey, payload, {
     json: options.json === true
   });
-  await logAndSyncLocalOpenApiForUpload(systemKey, manifest);
+  await logAndSyncLocalOpenApiForUpload(systemKey, manifest, { dataplaneUrl, authConfig });
   await handlePublicationAndFollowups(
     {
       systemKey,

package/lib/commands/verify-trust-command-action.js

@@ -39,7 +39,10 @@ async function runVerifyTrustCommandAction(appName, options, cmd) {
         systemKey: result.systemKey,
         command: result.command,
         verdict: result.verdict,
-        businessContextConfidencePercent: result.businessContextConfidencePercent,
+        aiTrustPercent: result.aiTrustPercent,
+        accessConfidencePercent: result.accessConfidencePercent,
+        businessConfidencePercent: result.businessConfidencePercent,
+        findings: result.findings,
         datasourceRows: opts.details ? result.datasourceRows : undefined
       },
       opts.details || opts.verbose

package/lib/commands/verify-trust-external.js

@@ -1,17 +1,13 @@
 /**
- * @fileoverview verify-trust orchestration with product-model rollup (plan 150.0).
+ * @fileoverview verify-trust orchestration with dual-confidence report (433.0).
  * @author AI Fabrix Team
- * @version 1.0.0
+ * @version 2.0.0
  */
 
 'use strict';
 
 const { runTestTrustForExternalSystem } = require('./test-trust-external');
-const {
-  VERDICT,
-  verdictFromPassed,
-  worstConfidencePercent
-} = require('../lifecycle/product-model');
+const { VERDICT, verdictFromPassed } = require('../lifecycle/product-model');
 
 /**
  * @param {Array<Object>} rows
@@ -20,14 +16,12 @@ const {
 function mapTrustDatasourceRows(rows) {
   return (rows || []).map(row => {
     const tr = row.trustRun;
-    const confidencePercent =
-      tr && typeof tr.confidence === 'number' ? Math.round(tr.confidence * 100) : null;
     const verdict = row.success ? VERDICT.VERIFIED : VERDICT.FAILED;
     return {
       datasourceKey: row.key,
       verdict,
-      confidencePercent,
       trustDecision: tr?.trustDecision,
+      validationStatus: tr?.validationStatus,
       error: row.error
     };
   });
@@ -40,22 +34,20 @@ function mapTrustDatasourceRows(rows) {
  * @returns {Promise<Object>}
  */
 async function runVerifyTrustForExternalSystem(systemKey, options = {}) {
-  const { success, results, systemKey: resolvedKey } = await runTestTrustForExternalSystem(
-    systemKey,
-    options
-  );
+  const { success, results, systemKey: resolvedKey, trustReport } =
+    await runTestTrustForExternalSystem(systemKey, options);
   const datasourceRows = mapTrustDatasourceRows(results);
-  const confidences = datasourceRows
-    .map(r => (typeof r.confidencePercent === 'number' ? r.confidencePercent / 100 : null))
-    .filter(v => v !== null);
-  const businessContextConfidencePercent = worstConfidencePercent(confidences);
-  const verdict = verdictFromPassed(success);
+  const report = trustReport || {};
+  const verdict = report.verdict ? report.verdict : verdictFromPassed(success);
 
   return {
     systemKey: resolvedKey || systemKey,
     command: 'verify-trust',
     verdict,
-    businessContextConfidencePercent,
+    aiTrustPercent: report.aiTrustPercent ?? null,
+    accessConfidencePercent: report.accessConfidencePercent ?? null,
+    businessConfidencePercent: report.businessConfidencePercent ?? null,
+    findings: Array.isArray(report.findings) ? report.findings : [],
     datasourceRows,
     results
   };

package/lib/core/config-setup-platform-mode.js

@@ -1,5 +1,5 @@
 /**
- * `setupPlatformMode` field in `config.yaml` (`single` | `full`).
+ * `setupPlatformMode` field in `config.yaml` (`single` | `single-traefik` | `full`).
  *
  * @fileoverview Persists setup wizard platform mode
  * @author AI Fabrix Team
@@ -15,7 +15,7 @@ const {
 
 /**
  * @param {() => Promise<Object>} getConfig
- * @returns {Promise<'single'|'full'>}
+ * @returns {Promise<'single'|'single-traefik'|'full'>}
  */
 async function getSetupPlatformModeFromConfig(getConfig) {
   const cfg = await getConfig();
@@ -29,7 +29,7 @@ async function getSetupPlatformModeFromConfig(getConfig) {
  * @param {() => Promise<Object>} getConfig
  * @param {(data: Object) => Promise<void>} saveConfig
  * @param {unknown} mode
- * @returns {Promise<'single'|'full'>}
+ * @returns {Promise<'single'|'single-traefik'|'full'>}
  */
 async function setSetupPlatformModeInConfig(getConfig, saveConfig, mode) {
   const normalized = normalizeSetupPlatformMode(mode);

package/lib/core/setup-platform-mode.js

@@ -1,5 +1,5 @@
 /**
- * Setup platform topology mode (`single` | `full`).
+ * Setup platform topology mode (`single` | `single-traefik` | `full`).
  *
  * This is distinct from `setupInstallationProfile` (dev/pro password bundle) and from
  * the login/run environment (`dev` | `tst` | `pro`).
@@ -14,12 +14,20 @@
 /** @enum {string} */
 const SETUP_PLATFORM_MODE = Object.freeze({
   SINGLE: 'single',
+  SINGLE_TRAEFIK: 'single-traefik',
   FULL: 'full'
 });
 
+/** @type {readonly string[]} */
+const SETUP_PLATFORM_MODE_CLI_VALUES = Object.freeze([
+  SETUP_PLATFORM_MODE.SINGLE,
+  SETUP_PLATFORM_MODE.SINGLE_TRAEFIK,
+  SETUP_PLATFORM_MODE.FULL
+]);
+
 /**
  * @param {unknown} value
- * @returns {'single'|'full'}
+ * @returns {'single'|'single-traefik'|'full'}
  */
 function normalizeSetupPlatformMode(value) {
   const raw = String(value ?? '')
@@ -27,6 +35,8 @@ function normalizeSetupPlatformMode(value) {
     .toLowerCase();
   if (raw === SETUP_PLATFORM_MODE.FULL) return SETUP_PLATFORM_MODE.FULL;
   if (raw === 'all' || raw === 'full-platform' || raw === 'platform-full') return SETUP_PLATFORM_MODE.FULL;
+  if (raw === SETUP_PLATFORM_MODE.SINGLE_TRAEFIK) return SETUP_PLATFORM_MODE.SINGLE_TRAEFIK;
+  if (raw === 'ingress' || raw === 'single-ingress' || raw === 'traefik') return SETUP_PLATFORM_MODE.SINGLE_TRAEFIK;
   return SETUP_PLATFORM_MODE.SINGLE;
 }
 
@@ -34,22 +44,47 @@ function normalizeSetupPlatformMode(value) {
  * Derived config flags for a chosen platform mode.
  *
  * - single: direct ports, no front door ingress
- * - full: enable Traefik ingress + env-scoped resources
+ * - single-traefik: Traefik front door (domain + TLS) for one environment only
+ * - full: Traefik ingress + env-scoped resources (multi-env; CLI only until menu returns)
  *
- * @param {'single'|'full'} mode
+ * @param {'single'|'single-traefik'|'full'} mode
  * @returns {{ traefik: boolean, useEnvironmentScopedResources: boolean }}
  */
 function flagsForSetupPlatformMode(mode) {
   const m = normalizeSetupPlatformMode(mode);
+  const traefik =
+    m === SETUP_PLATFORM_MODE.SINGLE_TRAEFIK || m === SETUP_PLATFORM_MODE.FULL;
   return {
-    traefik: m === SETUP_PLATFORM_MODE.FULL,
+    traefik,
     useEnvironmentScopedResources: m === SETUP_PLATFORM_MODE.FULL
   };
 }
 
+/**
+ * Interactive setup menu choices (full platform hidden until multi-env path ships).
+ *
+ * @returns {{ name: string, value: string }[]}
+ */
+function getSetupPlatformModePromptChoices() {
+  return [
+    {
+      name: 'Single environment — direct ports (no Traefik front door)',
+      value: SETUP_PLATFORM_MODE.SINGLE
+    },
+    {
+      name: 'Single environment — Traefik front door (domain + TLS)',
+      value: SETUP_PLATFORM_MODE.SINGLE_TRAEFIK
+    }
+    // Full platform — Traefik front door + miso/dev/tst/pro (shared infra) — menu returns soon.
+    // { name: 'Full platform — Traefik front door + miso/dev/tst/pro (shared infra)', value: SETUP_PLATFORM_MODE.FULL },
+  ];
+}
+
 module.exports = {
   SETUP_PLATFORM_MODE,
+  SETUP_PLATFORM_MODE_CLI_VALUES,
   normalizeSetupPlatformMode,
-  flagsForSetupPlatformMode
+  flagsForSetupPlatformMode,
+  getSetupPlatformModePromptChoices
 };
 

package/lib/datasource/capability/capability-diff-slice.js

@@ -7,6 +7,7 @@
  */
 
 const { deepClone } = require('./copy-operations');
+const { capabilitiesIncludes } = require('./capability-manifest');
 
 /**
  * @param {object} doc - Parsed datasource JSON
@@ -16,8 +17,7 @@ const { deepClone } = require('./copy-operations');
  */
 function extractCapabilitySliceForDiff(doc, capabilityKey, profileKey) {
   const cap = capabilityKey;
-  const listed =
-    Boolean(Array.isArray(doc.capabilities) && doc.capabilities.includes(cap));
+  const listed = capabilitiesIncludes(doc.capabilities, cap);
   const openapiOp = doc.openapi?.operations?.[cap];
   const cipOp = doc.execution?.cip?.operations?.[cap];
   let exposedProfile;

package/lib/datasource/capability/capability-manifest.js

@@ -0,0 +1,254 @@
+/**
+ * COM v2 capability object helpers for datasource manifests.
+ *
+ * @fileoverview capability-manifest
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const FORBIDDEN_ROOT_KEYS = new Set([
+  'context',
+  'origin',
+  'generatedBy',
+  'composition',
+  'generation',
+  'enterpriseResolver'
+]);
+
+const DEFAULT_RISK_BY_KEY = {
+  list: 'low',
+  get: 'low',
+  search: 'low',
+  create: 'medium',
+  update: 'medium',
+  delete: 'high'
+};
+
+const RESOURCE_TYPE_MAP = {
+  conversation: 'message',
+  user: 'employee',
+  person: 'employee',
+  record: 'document',
+  folder: 'document',
+  country: 'organization',
+  report: 'document',
+  calendar: 'event',
+  subscription: 'event'
+};
+
+/**
+ * @param {unknown} entry
+ * @returns {string}
+ */
+function capabilityKeyFromEntry(entry) {
+  if (typeof entry === 'string' && entry.trim()) {
+    return entry.trim();
+  }
+  if (entry && typeof entry === 'object' && typeof entry.key === 'string' && entry.key.trim()) {
+    return entry.key.trim();
+  }
+  return '';
+}
+
+/**
+ * @param {unknown} capabilities
+ * @returns {string[]}
+ */
+function listCapabilityKeys(capabilities) {
+  if (!Array.isArray(capabilities)) {
+    return [];
+  }
+  return capabilities.map(capabilityKeyFromEntry).filter(Boolean);
+}
+
+/**
+ * @param {unknown} capabilities
+ * @param {string} key
+ * @returns {boolean}
+ */
+function capabilitiesIncludes(capabilities, key) {
+  const target = String(key).toLowerCase();
+  return listCapabilityKeys(capabilities).some((item) => item.toLowerCase() === target);
+}
+
+/**
+ * @param {string} key
+ * @param {string} [displayName]
+ * @returns {object}
+ */
+function buildCapabilityObject(key, displayName) {
+  const normalized = String(key || '').trim();
+  const label = displayName && String(displayName).trim() ? String(displayName).trim() : 'records';
+  return {
+    key: normalized,
+    description: `${normalized} operation on ${label}`,
+    riskLevel: DEFAULT_RISK_BY_KEY[normalized.toLowerCase()] || 'medium',
+    approvalRequired: false
+  };
+}
+
+/**
+ * @param {object} parsed
+ * @returns {object[]}
+ */
+function normalizeCapabilitiesToObjects(parsed) {
+  const caps = parsed?.capabilities;
+  const displayName = parsed?.displayName || parsed?.key || 'records';
+  if (!Array.isArray(caps) || caps.length === 0) {
+    return [];
+  }
+  const out = [];
+  const seen = new Set();
+  caps.forEach((item) => {
+    if (typeof item === 'string' && item.trim()) {
+      const key = item.trim();
+      if (seen.has(key)) return;
+      seen.add(key);
+      out.push(buildCapabilityObject(key, displayName));
+      return;
+    }
+    if (!item || typeof item !== 'object') return;
+    const key = capabilityKeyFromEntry(item);
+    if (!key || seen.has(key)) return;
+    seen.add(key);
+    const row = buildCapabilityObject(key, displayName);
+    if (typeof item.description === 'string' && item.description.trim()) {
+      row.description = item.description.trim();
+    }
+    if (typeof item.riskLevel === 'string' && item.riskLevel.trim()) {
+      row.riskLevel = item.riskLevel.trim();
+    }
+    if (item.approvalRequired === true) {
+      row.approvalRequired = true;
+    }
+    out.push(row);
+  });
+  return out;
+}
+
+/**
+ * @param {object} node
+ * @returns {void}
+ */
+function stripSemanticExtras(node) {
+  if (!node || typeof node !== 'object') return;
+  const semantic = node.semantic;
+  if (semantic && typeof semantic === 'object') {
+    delete semantic.categories;
+    delete semantic.synonyms;
+    if (Object.keys(semantic).length === 0) {
+      delete node.semantic;
+    }
+  }
+  Object.values(node).forEach((value) => {
+    if (value && typeof value === 'object') {
+      if (Array.isArray(value)) {
+        value.forEach((item) => stripSemanticExtras(item));
+      } else {
+        stripSemanticExtras(value);
+      }
+    }
+  });
+}
+
+/**
+ * @param {object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function removeForbiddenComRootKeys(parsed, changes) {
+  let updated = false;
+  FORBIDDEN_ROOT_KEYS.forEach((key) => {
+    if (Object.prototype.hasOwnProperty.call(parsed, key)) {
+      delete parsed[key];
+      changes.push(`Removed forbidden COM v2 root key: ${key}`);
+      updated = true;
+    }
+  });
+  return updated;
+}
+
+/**
+ * @param {object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function stripFieldMappingSemanticExtras(parsed, changes) {
+  if (!parsed.fieldMappings) {
+    return false;
+  }
+  const before = JSON.stringify(parsed.fieldMappings);
+  stripSemanticExtras(parsed.fieldMappings);
+  if (JSON.stringify(parsed.fieldMappings) === before) {
+    return false;
+  }
+  changes.push('Removed fieldMappings.*.semantic.categories/synonyms (COM v2)');
+  return true;
+}
+
+/**
+ * @param {object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function applyResourceTypeCatalogMap(parsed, changes) {
+  const resourceType = parsed.resourceType;
+  if (typeof resourceType !== 'string') {
+    return false;
+  }
+  const mapped = RESOURCE_TYPE_MAP[resourceType.trim()];
+  if (!mapped) {
+    return false;
+  }
+  parsed.resourceType = mapped;
+  changes.push(`Mapped resourceType ${resourceType} → ${mapped}`);
+  return true;
+}
+
+/**
+ * @param {object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function migrateCapabilitiesToComObjects(parsed, changes) {
+  const caps = parsed.capabilities;
+  const needsObjectMigration = Array.isArray(caps)
+    && caps.some((item) => typeof item === 'string' || (item && typeof item === 'object' && !item.key));
+  const hasStringCapabilities = Array.isArray(caps) && caps.length > 0 && typeof caps[0] === 'string';
+  if (!needsObjectMigration && !hasStringCapabilities) {
+    return false;
+  }
+  parsed.capabilities = normalizeCapabilitiesToObjects(parsed);
+  changes.push('Migrated capabilities[] to COM v2 capability objects');
+  return true;
+}
+
+/**
+ * @param {object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function repairComV2Manifest(parsed, changes) {
+  if (!parsed || typeof parsed !== 'object') {
+    return false;
+  }
+  return [
+    removeForbiddenComRootKeys(parsed, changes),
+    stripFieldMappingSemanticExtras(parsed, changes),
+    applyResourceTypeCatalogMap(parsed, changes),
+    migrateCapabilitiesToComObjects(parsed, changes)
+  ].some(Boolean);
+}
+
+module.exports = {
+  FORBIDDEN_ROOT_KEYS,
+  capabilityKeyFromEntry,
+  listCapabilityKeys,
+  capabilitiesIncludes,
+  buildCapabilityObject,
+  normalizeCapabilitiesToObjects,
+  stripSemanticExtras,
+  repairComV2Manifest
+};

package/lib/datasource/capability/capability-resolve.js

@@ -6,6 +6,8 @@
  * @version 2.0.0
  */
 
+const { capabilitiesIncludes } = require('./capability-manifest');
+
 /**
  * @param {object|undefined} operations
  * @param {string} logicalKey
@@ -146,10 +148,7 @@ function resolveProfileKeyForLogical(doc, logicalKey) {
  * @returns {boolean}
  */
 function capabilityLogicalExists(doc, name) {
-  if (
-    Array.isArray(doc.capabilities) &&
-    doc.capabilities.some((c) => String(c).toLowerCase() === String(name).toLowerCase())
-  ) {
+  if (capabilitiesIncludes(doc.capabilities, name)) {
     return true;
   }
   if (findMatchingOpsKeys(doc.openapi?.operations, name).length > 0) {

package/lib/datasource/capability/copy-operations.js

@@ -7,6 +7,7 @@
  */
 
 const { rewriteCapabilityReferences } = require('./reference-rewrite');
+const { capabilityKeyFromEntry } = require('./capability-manifest');
 const { jsonPointerPath } = require('./json-pointer');
 const { buildBasicExposureProfileArray } = require('./basic-exposure');
 const {
@@ -53,9 +54,10 @@ function removeCapability(doc, logicalKey) {
   const profileKey = resolveProfileKeyForLogical(doc, logicalKey);
 
   if (Array.isArray(doc.capabilities)) {
-    doc.capabilities = doc.capabilities.filter(
-      (c) => String(c).toLowerCase() !== String(logicalKey).toLowerCase()
-    );
+    doc.capabilities = doc.capabilities.filter((c) => {
+      const key = capabilityKeyFromEntry(c);
+      return key.toLowerCase() !== String(logicalKey).toLowerCase();
+    });
   }
   if (openapiKey && oo) {
     delete oo[openapiKey];

package/lib/datasource/capability/remove-operations.js

@@ -17,6 +17,7 @@ const {
   findMatchingOpsKeys,
   resolveProfileKeyForLogical
 } = require('./capability-resolve');
+const { capabilityKeyFromEntry } = require('./capability-manifest');
 
 /**
  * @param {unknown} capabilities
@@ -28,7 +29,7 @@ function findCapabilityIndex(capabilities, logicalName) {
     return -1;
   }
   return capabilities.findIndex(
-    (c) => String(c).toLowerCase() === String(logicalName).toLowerCase()
+    (c) => capabilityKeyFromEntry(c).toLowerCase() === String(logicalName).toLowerCase()
   );
 }
 

package/lib/datasource/capability/run-capability-copy.js

@@ -8,6 +8,7 @@
 
 const fs = require('node:fs');
 const path = require('path');
+const { loadConfigFile, writeConfigFile } = require('../../utils/config-format');
 const { writeBackup } = require('../../utils/integration-file-backup');
 const {
   resolveValidateInputPath,
@@ -46,6 +47,33 @@ function resolveCapabilityCopyInputPath(identifier) {
   return resolveValidateInputPath(trimmed);
 }
 
+/**
+ * Read a datasource config file (.json, .yaml, or .yml).
+ *
+ * @param {string} filePath
+ * @returns {object}
+ */
+function readDatasourceConfigFile(filePath) {
+  return loadConfigFile(filePath);
+}
+
+/**
+ * @param {string} filePath
+ * @returns {'json'|'yaml'}
+ */
+function inferDatasourceConfigFormat(filePath) {
+  const ext = path.extname(filePath).toLowerCase();
+  if (ext === '.json') {
+    return 'json';
+  }
+  if (ext === '.yaml' || ext === '.yml') {
+    return 'yaml';
+  }
+  throw new Error(
+    `Unsupported datasource config extension: ${ext || '(none)'}. Use .json, .yaml, or .yml`
+  );
+}
+
 /**
  * @param {string} filePath
  * @param {object} obj
@@ -53,9 +81,9 @@ function resolveCapabilityCopyInputPath(identifier) {
  */
 function atomicWriteJson(filePath, obj) {
   const dir = path.dirname(filePath);
+  const format = inferDatasourceConfigFormat(filePath);
   const tmp = path.join(dir, `.${path.basename(filePath)}.${process.pid}.tmp`);
-  const payload = `${JSON.stringify(obj, null, 2)}\n`;
-  fs.writeFileSync(tmp, payload, 'utf8');
+  writeConfigFile(tmp, obj, format);
   fs.renameSync(tmp, filePath);
 }
 
@@ -89,8 +117,7 @@ function atomicWriteJson(filePath, obj) {
  */
 async function runCapabilityCopy(opts) {
   const resolvedPath = resolveCapabilityCopyInputPath(opts.fileOrKey.trim());
-  const raw = fs.readFileSync(resolvedPath, 'utf8');
-  const parsed = JSON.parse(raw);
+  const parsed = readDatasourceConfigFile(resolvedPath);
 
   const to = normalizeCapabilityKey(opts.as, 'Target (--as)');
   const fromRaw = opts.from !== undefined && opts.from !== null ? String(opts.from).trim() : '';
@@ -148,5 +175,6 @@ async function runCapabilityCopy(opts) {
 module.exports = {
   runCapabilityCopy,
   writeBackup,
+  readDatasourceConfigFile,
   atomicWriteJson
 };